On the Indistinguishability of Human v/s AI Generated Text

# On the Indistinguishability of Human v/s AI Generated Text
Source: [https://arxiv.org/html/2608.26797](https://arxiv.org/html/2608.26797)
Aritra DasMihir MoreDebayan GuptaAffiliation:Truth Audit LabsAffiliation:\{jaee, aritra, mihir, debayan\}@truthauditlabs\.ai

July 2026

###### Abstract

The rapid improvement of LLMs has made distinguishing AI\-generated text from human writing a pressing problem\. This challenge is further amplified by paraphrasing tools designed to make machine\-generated text appear more "human"\. We study how access to human writing samples can be used to strategically paraphrase machine\-generated responses toward the human distribution\. Under a multi\-sample setting with human and machine responses to the same prompts, we show that repeated paraphrasing moves the machine distribution toward the empirical human distribution under simple mixing and stability conditions\. Our results derive an explicit convergence rate, extend the analysis to a finite\-sample setting, and characterize how the required number of human samples and paraphrasing rounds scale with the desired error\.

## 1Introduction

Large language models can now generate fluent, convincing text across a wide range of academic tasks\. Their growing use in academia has raised serious concerns about plagiarism, undisclosed AI assistance, and the integrity of written submissions[Johnston et al\. \(2024\)](https://arxiv.org/html/2608.26797#bib.bib26)\. Recent studies show that AI\-generated academic writing can achieve quality comparable to human\-written work, making authorship increasingly difficult to infer from the text alone[Yeadon et al\. \(2024\)](https://arxiv.org/html/2608.26797#bib.bib27)\. In response, universities and other institutions have increasingly turned to AI\-text detection tools as part of their academic\-integrity processes[Weber\-Wulff et al\. \(2023\)](https://arxiv.org/html/2608.26797#bib.bib7)\. However, these detectors are fragile to rewriting\. Prior work shows that paraphrasing or repeated rewriting can substantially reduce the detectability of machine\-generated text while preserving its content and quality[Sadasivan et al\. \(2023\)](https://arxiv.org/html/2608.26797#bib.bib9);[Weber\-Wulff et al\. \(2023\)](https://arxiv.org/html/2608.26797#bib.bib7)\. Understanding how repeated paraphrasing changes machine\-generated text, and in particular whether it systematically moves such text toward the human distribution, is therefore a crucial problem for reliable AI\-text attribution\.

A useful way to understand the limits of AI\-text detection is through the distance between the human and machine distributions\. Sadasivan et al\.[Sadasivan et al\. \(2023\)](https://arxiv.org/html/2608.26797#bib.bib9)show that detecting a single machine\-generated response can become unreliable once machine text is sufficiently similar to human writing\. In particular, they argue that no detector can remain reliable when the human and machine text distributions become too close, and they further show that repeated paraphrasing can substantially weaken existing detectors\. Chakraborty et al\.[Chakraborty et al\. \(2024\)](https://arxiv.org/html/2608.26797#bib.bib10)give a complementary result: even if individual responses are difficult to distinguish, access to many independent responses makes detection possible, because small differences between the human and machine distributions accumulate across samples\.

An interesting question is the adversarial version of the multi\-sample setting\. In practice, an adversary may not only have access to machine\-generated text, but also to examples of how a particular person writes\. These human examples can then be used to guide repeated paraphrasing of the machine text\. For instance, given a student’s past essays and machine\-generated essays on the same topics, can the machine essays be rewritten to increasingly resemble the student’s writing while preserving their meaning and quality?

We study this dynamic of human\-guided paraphrasing and formalize when access to human examples can progressively move machine\-generated text toward the human distribution, how quickly this movement occurs, and how much human data is required\. Our main contributions are:

- •We show that repeated, semantics\-preserving perturbations can move the machine\-generated distribution toward the empirical human distribution, with an explicit convergence rate \(Theorem[1](https://arxiv.org/html/2608.26797#Thmtheorem1)\)\.
- •We extend this guarantee to finite samples, bounding the distance between the observed perturbed\-machine distribution and the true human distribution after a finite semantic representation \(Theorem[2](https://arxiv.org/html/2608.26797#Thmtheorem2)\)\.
- •We show that the paraphraser becomes increasingly stable on human writing as more human examples are available, with this stability improving at a square\-root rate \(Theorem[3](https://arxiv.org/html/2608.26797#Thmtheorem3)\)\.

## 2Preliminaries

Before discussing the results, we define the main notations used in this paper\. Let𝒳\\mathcal\{X\}denote the space of prompts and let𝒴\\mathcal\{Y\}denote the space of textual outputs\. For a promptx∈𝒳x\\in\\mathcal\{X\}, letPM​\(y∣x\)P\_\{M\}\(y\\mid x\)denote the distribution of machine\-generated responses and letPH​\(y∣x\)P\_\{H\}\(y\\mid x\)denote the distribution of human\-written responses\. In practice, the true human distribution is unknown, and we instead observe

ℋm=\{h1,…,hm\},hj∼iidPH\(⋅∣x\),\\mathcal\{H\}\_\{m\}=\\\{h\_\{1\},\\ldots,h\_\{m\}\\\},\\qquad h\_\{j\}\\overset\{\\mathrm\{iid\}\}\{\\sim\}P\_\{H\}\(\\,\\cdot\\mid x\),and

ℳp=\{y1,…,yp\},yi∼iidPM\(⋅∣x\)\.\\mathcal\{M\}\_\{p\}=\\\{y\_\{1\},\\ldots,y\_\{p\}\\\},\\qquad y\_\{i\}\\overset\{\\mathrm\{iid\}\}\{\\sim\}P\_\{M\}\(\\,\\cdot\\mid x\)\.
###### Definition 1\(Empirical distributions\)\.

These samples define the empirical distributions

P^H\(m\)=1m​∑j=1mδhj,P^M\(p\)=1p​∑i=1pδyi,\\widehat\{P\}\_\{H\}^\{\(m\)\}=\\frac\{1\}\{m\}\\sum\_\{j=1\}^\{m\}\\delta\_\{h\_\{j\}\},\\qquad\\widehat\{P\}\_\{M\}^\{\(p\)\}=\\frac\{1\}\{p\}\\sum\_\{i=1\}^\{p\}\\delta\_\{y\_\{i\}\},whereδz\\delta\_\{z\}places probability one onzz\.

Throughout, we use Total Variation distance,dTV​\(P,Q\)=12​∑z∈𝒴\|P⁡\(z\)−Q⁡\(z\)\|\.d\_\{\\mathrm\{TV\}\}\(P,Q\)=\\frac\{1\}\{2\}\\sum\_\{z\\in\\mathcal\{Y\}\}\\left\|P\(z\)\-Q\(z\)\\right\|\.

###### Definition 2\(Quality control oracle\)\.

The quality control oracle is defined asQ:𝒳×𝒴→\[0,1\]Q:\\mathcal\{X\}\\times\\mathcal\{Y\}\\to\[0,1\]\. The valueQ⁡\(x,z\)Q\(x,z\)measures whetherzzis a correct, relevant, clear, and useful response to promptxx\. Fix a quality thresholdq0q\_\{0\}\. An output is accepted only ifQ⁡\(x,z\)≥q0Q\(x,z\)\\geq q\_\{0\}\.

###### Definition 3\(Semantic preservation oracle\)\.

Let𝒵\\mathcal\{Z\}be the space of all perturbed outputs\.Sem:𝒳×𝒴×𝒵→\[0,1\]\\mathrm\{Sem\}:\\mathcal\{X\}\\times\\mathcal\{Y\}\\times\\mathcal\{Z\}\\to\[0,1\]\. The valueSem⁡\(x,y,z\)\\mathrm\{Sem\}\(x,y,z\)measures whetherzzpreserves the meaning of the original responseyyfor promptxx\. We fix a thresholds0s\_\{0\}\. A rewrite ofyyis accepted only ifSem⁡\(x,y,z\)≥s0\\mathrm\{Sem\}\(x,y,z\)\\geq s\_\{0\}\.

We argue that these tools are available in real life, wherein existing detectors can instantiateDD, whileQQandSem\\mathrm\{Sem\}can be implemented using the language model itself as an evaluator\. For repeated perturbations of an original responseyiy\_\{i\}, semantic preservation is always checked againstyiy\_\{i\}, not only against the most recent rewrite, preventing a sequence of individually small changes from drifting into a different answer\. Define the admissible set foryiy\_\{i\}by

𝒜i=\{z∈𝒴:Q⁡\(x,z\)≥q0​and​Sem​\(x,yi,z\)≥s0\}\.\\mathcal\{A\}\_\{i\}=\\left\\\{z\\in\\mathcal\{Y\}:Q\(x,z\)\\geq q\_\{0\}\\ \\text\{and\}\\ \\mathrm\{Sem\}\(x,y\_\{i\},z\)\\geq s\_\{0\}\\right\\\}\.
###### Definition 4\(Quality\-conditioned perturbation kernel\)\.

We begin with a base rewrite ruleRi,m​\(z′∣z\)R\_\{i,m\}\(z^\{\\prime\}\\mid z\)that generates candidate perturbations of the current response\. The accepted kernel is then obtained by restricting this proposal to rewrites that satisfy the quality and semantic\-preservation constraints\. It may use the human sampleℋm\\mathcal\{H\}\_\{m\}\. The accepted perturbation kernel is

Ti,m​\(z,z′\)=Ri,m\(z′∣z\)𝟏\{z′∈𝒜i\}∑u∈𝒴Ri,m\(u∣z\)𝟏\{u∈𝒜i\}\.T\_\{i,m\}\(z,z^\{\\prime\}\)=\\frac\{R\_\{i,m\}\(z^\{\\prime\}\\mid z\)\\mathbf\{1\}\\\{z^\{\\prime\}\\in\\mathcal\{A\}\_\{i\}\\\}\}\{\\displaystyle\\sum\_\{u\\in\\mathcal\{Y\}\}R\_\{i,m\}\(u\\mid z\)\\mathbf\{1\}\\\{u\\in\\mathcal\{A\}\_\{i\}\\\}\}\.
We assume that the denominator is positive for every state reached by the process\. HenceTi,m​\(z,𝒜i\)=1T\_\{i,m\}\(z,\\mathcal\{A\}\_\{i\}\)=1\. For a distributionPPon𝒴\\mathcal\{Y\}, writeP​Ti,mPT\_\{i,m\}for the distribution after one perturbation step:

\(P​Ti,m\)​\(z′\)=∑z∈𝒴P⁡\(z\)​Ti,m​\(z,z′\)\.\(PT\_\{i,m\}\)\(z^\{\\prime\}\)=\\sum\_\{z\\in\\mathcal\{Y\}\}P\(z\)T\_\{i,m\}\(z,z^\{\\prime\}\)\.

We claim that such kernels are plausible in practice consistent with work showing strong semantic preservation and modest quality degradation in paraphrasing tools\.[Masrour et al\. \(2025\)](https://arxiv.org/html/2608.26797#bib.bib15);[Sadasivan et al\. \(2023\)](https://arxiv.org/html/2608.26797#bib.bib9);[Xu et al\. \(2026\)](https://arxiv.org/html/2608.26797#bib.bib16)\.

###### Assumption 1\(Human admissibility\)\.

For every machine responseyiy\_\{i\}and every human responsehj∈ℋmh\_\{j\}\\in\\mathcal\{H\}\_\{m\},

Q⁡\(x,hj\)≥q0andSem⁡\(x,yi,hj\)≥s0\.Q\(x,h\_\{j\}\)\\geq q\_\{0\}\\qquad\\text\{and\}\\qquad\\operatorname\{Sem\}\(x,y\_\{i\},h\_\{j\}\)\\geq s\_\{0\}\.Equivalently, every human response lies in the admissible setAiA\_\{i\}, so that

P^H\(m\)​\(Ai\)=1for every​i\.\\widehat\{P\}\_\{H\}^\{\(m\)\}\(A\_\{i\}\)=1\\qquad\\text\{for every \}i\.This is natural in our setting, since the human and machine responses correspond to the same prompt and are intended to represent comparable answers\.

###### Assumption 2\(Human stability\)\.

We define the empirical human stability by

εm=max1≤i≤p⁡dTV​\(P^H\(m\)​Ti,m,P^H\(m\)\)\.\\varepsilon\_\{m\}=\\max\_\{1\\leq i\\leq p\}d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\.\(2\.1\)
The human stability parameterεm\\varepsilon\_\{m\}measures how much the perturbation oracle shifts the empirical human distribution\. A smallεm\\varepsilon\_\{m\}means human text is approximately stationary under the paraphraser\.

###### Assumption 3\(Block mixing\)\.

There exist an integer block lengthℓm≥1\\ell\_\{m\}\\geq 1and a constantρm∈\[0,1\)\\rho\_\{m\}\\in\[0,1\)such that, for everyiiand all distributionsPPandQQsupported on𝒜i\\mathcal\{A\}\_\{i\},

dTV​\(P​Ti,mℓm,Q​Ti,mℓm\)≤ρm​dTV​\(P,Q\)\.d\_\{\\mathrm\{TV\}\}\\left\(PT\_\{i,m\}^\{\\ell\_\{m\}\},QT\_\{i,m\}^\{\\ell\_\{m\}\}\\right\)\\leq\\rho\_\{m\}d\_\{\\mathrm\{TV\}\}\(P,Q\)\.\(2\.2\)Assumption[3](https://arxiv.org/html/2608.26797#Thmassumption3)formalizes the idea that repeated perturbations make the output progressively forget its starting point\.ℓm\\ell\_\{m\}ensures that contraction need not occur at every rewrite\. It is sufficient that it emerges over blocks of perturbations\. Proposition[1](https://arxiv.org/html/2608.26797#Thmproposition1)gives a simple condition under which this behavior is guaranteed\.\([Rosenthal, 1995](https://arxiv.org/html/2608.26797#bib.bib25)\)

## 3Related Work

#### AI\-generated text detection\.

Early detectors used statistical patterns in a language model’s token probabilities\. GLTR, for example, displays token ranks to help a reader identify generated text\([Gehrmann et al\., 2019](https://arxiv.org/html/2608.26797#bib.bib1)\)\. Later systems learned classifiers from human and machine examples, or combined signals from several language models\([Verma et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib2)\)\. Zero\-shot methods avoid training a separate detector\.\([Mitchell et al\., 2023](https://arxiv.org/html/2608.26797#bib.bib3);[Bao et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib4)\)\. A separate line of work inserts a statistical watermark during generation and tests for that signal later\([Kirchenbauer et al\., 2023](https://arxiv.org/html/2608.26797#bib.bib5)\)\. These methods can be effective in the setting in which they are tested\. Their performance, however, can change under new generators, domains, decoding rules, and edits\([Weber\-Wulff et al\., 2023](https://arxiv.org/html/2608.26797#bib.bib7);[Dugan et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib6)\)\. We do not propose another detector\. We study how the distribution that a detector must distinguish changes under repeated rewriting\.

#### Limits of AI detection

Several papers study detection as a statistical testing problem\. Varshney et al\.\([Varshney et al\., 2020](https://arxiv.org/html/2608.26797#bib.bib8)\)analyze limits that arise when machine text closely matches human text\. Sadasivan et al\.\([Sadasivan et al\., 2023](https://arxiv.org/html/2608.26797#bib.bib9)\)give a sharper distributional view\. They relate the performance of the best single\-text detector to the Total Variation distance between the human and machine distributions\. They also show empirically that recursive paraphrasing can lower the accuracy of many detectors while causing only modest quality loss\. Chakraborty et al\.\([Chakraborty et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib10)\)study the complementary multi\-sample setting\. They show that small differences between fixed human and machine distributions can accumulate when a detector receives many independent responses\.

#### Paraphrasing Attacks\.

A large empirical literature shows that rewriting weakens machine\-text detectors\. DIPPER is a paragraph\-level paraphraser with controls for lexical diversity and content order\. It preserves the main meaning of a passage while evading several detector families\([Krishna et al\., 2023](https://arxiv.org/html/2608.26797#bib.bib11)\)\. Recursive paraphrasing strengthens this attack by applying a paraphraser more than once\([Sadasivan et al\., 2023](https://arxiv.org/html/2608.26797#bib.bib9)\)\. Other attacks replace selected words or search for prompts that change writing style\([Shi et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib12)\)\. Detector scores can also be used as training rewards\. This produces generators that are directly optimized to be hard to detect\([Nicks et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib13)\)\. More recent work guides token selection with a detector during paraphrase generation\([Cheng et al\., 2025](https://arxiv.org/html/2608.26797#bib.bib14)\)\.

#### Authorship Obfuscation

Our use of human examples is also related to authorship obfuscation and style transfer\. Early attacks changed a document until an authorship classifier no longer linked it to its writer\([Brennan and Greenstadt, 2009](https://arxiv.org/html/2608.26797#bib.bib17);[Bevendorff et al\., 2019](https://arxiv.org/html/2608.26797#bib.bib18)\)\. Combinatorial paraphrasing later improved content preservation and supported both untargeted obfuscation and imitation of a chosen writing style\([Gröndahl and Asokan, 2020](https://arxiv.org/html/2608.26797#bib.bib19)\)\. Low\-resource style\-transfer methods use a small set of target\-author examples and optimize a balance between style change and semantic preservation\([Liu et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib20)\)\.

#### Repeated rewriting as a dynamical process\.

Other work studies what repeated rewriting does over many rounds\. Tripto et al\.\([Tripto et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib21)\)show that successive paraphrases preserve much of the content but progressively replace the original author’s style with the paraphraser’s style\. Wang et al\.\([Wang et al\., 2025](https://arxiv.org/html/2608.26797#bib.bib22)\)view successive paraphrasing as a dynamical system and observe fixed points and short attractor cycles\. Geng et al\.\([Geng et al\., 2026](https://arxiv.org/html/2608.26797#bib.bib23)\)model iterative rephrasing as a Markov chain and study recurrence, diversity, and the effect of decoding choices\.

#### Quality Preserving Perturbations\.

A closely related theoretical use of a mixing perturbation process appears in the watermarking literature\. Zhang et al\.\([Zhang et al\., 2024](https://arxiv.org/html/2608.26797#bib.bib24)\)assume a quality oracle and a perturbation oracle that induces a rapidly mixing walk over high\-quality outputs\. They use this process to show that a strong watermark can be removed without knowing the secret key\.

## 4Our Results

### 4\.1Convergence of the full distribution

We first give a simple sufficient condition for block mixing\. It is a Doeblin condition on theℓm\\ell\_\{m\}\-step kernel, not on every individual perturbation step\.

###### Proposition 1\(Sufficient block\-mixing condition\)\.

Suppose there exists a numberλm∈\(0,1\]\\lambda\_\{m\}\\in\(0,1\]and, for everyii, a probability distributionνi,m\\nu\_\{i,m\}such that, for everyz∈Aiz\\in A\_\{i\},

Ti,mℓm​\(z,⋅\)=λm​νi,m​\(⋅\)\+\(1−λm\)​μi,m,z​\(⋅\),T\_\{i,m\}^\{\\ell\_\{m\}\}\(z,\\cdot\)=\\lambda\_\{m\}\\nu\_\{i,m\}\(\\cdot\)\+\(1\-\\lambda\_\{m\}\)\\mu\_\{i,m,z\}\(\\cdot\),whereμi,m,z\\mu\_\{i,m,z\}is a probability distribution that may depend onzz\. Then Assumption[3](https://arxiv.org/html/2608.26797#Thmassumption3)holds with

ρm≤1−λm\.\\rho\_\{m\}\\leq 1\-\\lambda\_\{m\}\.

###### Proof\.

For any distributionsPPandQQsupported onAiA\_\{i\}, applying \(3\.1\) gives

P​Ti,mℓm=λm​νi,m\+\(1−λm\)​P​μi,m,PT\_\{i,m\}^\{\\ell\_\{m\}\}=\\lambda\_\{m\}\\nu\_\{i,m\}\+\(1\-\\lambda\_\{m\}\)P\\mu\_\{i,m\},and similarly,

Q​Ti,mℓm=λm​νi,m\+\(1−λm\)​Q​μi,m\.QT\_\{i,m\}^\{\\ell\_\{m\}\}=\\lambda\_\{m\}\\nu\_\{i,m\}\+\(1\-\\lambda\_\{m\}\)Q\\mu\_\{i,m\}\.
The common componentλm​νi,m\\lambda\_\{m\}\\nu\_\{i,m\}cancels when taking Total Variation distance, so

dTV​\(P​Ti,mℓm,Q​Ti,mℓm\)=\(1−λm\)​dTV​\(P​μi,m,Q​μi,m\)\.d\_\{\\mathrm\{TV\}\}\\left\(PT\_\{i,m\}^\{\\ell\_\{m\}\},QT\_\{i,m\}^\{\\ell\_\{m\}\}\\right\)=\(1\-\\lambda\_\{m\}\)d\_\{\\mathrm\{TV\}\}\\left\(P\\mu\_\{i,m\},Q\\mu\_\{i,m\}\\right\)\.
Since Markov kernels are nonexpansive in Total Variation,

dTV​\(P​Ti,mℓm,Q​Ti,mℓm\)≤\(1−λm\)​dTV​\(P,Q\)\.d\_\{\\mathrm\{TV\}\}\\left\(PT\_\{i,m\}^\{\\ell\_\{m\}\},QT\_\{i,m\}^\{\\ell\_\{m\}\}\\right\)\\leq\(1\-\\lambda\_\{m\}\)d\_\{\\mathrm\{TV\}\}\(P,Q\)\.
Hence Assumption[3](https://arxiv.org/html/2608.26797#Thmassumption3)holds withρm≤1−λm\\rho\_\{m\}\\leq 1\-\\lambda\_\{m\}\. ∎

Condition \(3\.1\) states that, afterℓm\\ell\_\{m\}perturbations, at least aλm\\lambda\_\{m\}fraction of the output distribution is common across all starting responses\. Thus only the remaining1−λm1\-\\lambda\_\{m\}fraction can retain information about the initial response, which directly gives the block contraction in Assumption[3](https://arxiv.org/html/2608.26797#Thmassumption3)\.

### 4\.2Convergence of the empirical distribution

For each starting machine responseyiy\_\{i\}, definePi,0=δyi,Pi,k=δyi​Ti,mk\.P\_\{i,0\}=\\delta\_\{y\_\{i\}\},P\_\{i,k\}=\\delta\_\{y\_\{i\}\}T\_\{i,m\}^\{k\}\.The average perturbed machine law isP¯M,k\(p,m\)=1p​∑i=1pPi,k\.\\overline\{P\}\_\{M,k\}^\{\(p,m\)\}=\\frac\{1\}\{p\}\\sum\_\{i=1\}^\{p\}P\_\{i,k\}\.

###### Lemma 1\(Preservation at every round\)\.

Under the human admissibility and quality

Pi,k​\(𝒜i\)=1P\_\{i,k\}\(\\mathcal\{A\}\_\{i\}\)=1\(4\.1\)for everyiiand everyk≥0k\\geq 0\.

###### Proof\.

The claim holds atk=0k=0because the original response is assumed admissible\. If it holds at roundkk, the quality and meaning preservation condition places the next output in𝒜i\\mathcal\{A\}\_\{i\}with probability one\. Induction completes the proof\. ∎

Define the initial average distanceΔ¯0=1p​∑i=1pdTV​\(δyi,P^H\(m\)\)\.\\overline\{\\Delta\}\_\{0\}=\\frac\{1\}\{p\}\\sum\_\{i=1\}^\{p\}d\_\{\\mathrm\{TV\}\}\\left\(\\delta\_\{y\_\{i\}\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\.

###### Theorem 1\(Empirical machine\-to\-human movement under block mixing\)\.

We show that repeated perturbations progressively erase dependence on the initial machine response, while human stability keeps the resulting distribution close to the empirical human distribution\.

For eachk≥0k\\geq 0, write

k=qk​ℓm\+rk,qk=⌊kℓm⌋,0≤rk<ℓm\.k=q\_\{k\}\\ell\_\{m\}\+r\_\{k\},\\qquad q\_\{k\}=\\left\\lfloor\\frac\{k\}\{\\ell\_\{m\}\}\\right\\rfloor,\\qquad 0\\leq r\_\{k\}<\\ell\_\{m\}\.\(4\.2\)Under human admissibility, quality and meaning preservation, and conditions\(1\)–\(2\), for everyiiand everyk≥0k\\geq 0,

dTV​\(Pi,k,P^H\(m\)\)≤ρmqk​dTV​\(δyi,P^H\(m\)\)\+\(ℓm​1−ρmqk1−ρm\+rk\)​εm\.d\_\{\\mathrm\{TV\}\}\\left\(P\_\{i,k\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\\leq\\rho\_\{m\}^\{q\_\{k\}\}d\_\{\\mathrm\{TV\}\}\\left\(\\delta\_\{y\_\{i\}\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\+\\left\(\\ell\_\{m\}\\frac\{1\-\\rho\_\{m\}^\{q\_\{k\}\}\}\{1\-\\rho\_\{m\}\}\+r\_\{k\}\\right\)\\varepsilon\_\{m\}\.\(4\.3\)Consequently,

dTV​\(P¯M,k\(p,m\),P^H\(m\)\)≤bk,m,p\\boxed\{d\_\{\\mathrm\{TV\}\}\\left\(\\overline\{P\}\_\{M,k\}^\{\(p,m\)\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\\leq b\_\{k,m,p\}\}\(4\.4\)where

bk,m,p=ρmqk​Δ¯0\+\(ℓm​1−ρmqk1−ρm\+rk\)​εm\.b\_\{k,m,p\}=\\rho\_\{m\}^\{q\_\{k\}\}\\overline\{\\Delta\}\_\{0\}\+\\left\(\\ell\_\{m\}\\frac\{1\-\\rho\_\{m\}^\{q\_\{k\}\}\}\{1\-\\rho\_\{m\}\}\+r\_\{k\}\\right\)\\varepsilon\_\{m\}\.\(4\.5\)

###### Proof\.

Fixiiand write

Δi,k=dTV​\(Pi,k,P^H\(m\)\)\.\\Delta\_\{i,k\}=d\_\{\\mathrm\{TV\}\}\\left\(P\_\{i,k\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\.\(4\.6\)First, one\-step stability and nonexpansiveness of Markov kernels imply that, for every integers≥1s\\geq 1,

dTV​\(P^H\(m\)​Ti,ms,P^H\(m\)\)\\displaystyle d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\}^\{s\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)≤∑j=0s−1dTV​\(P^H\(m\)​Ti,mj\+1,P^H\(m\)​Ti,mj\)\\displaystyle\\leq\\sum\_\{j=0\}^\{s\-1\}d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\}^\{j\+1\},\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\}^\{j\}\\right\)\(4\.7\)≤s​εm\.\\displaystyle\\leq s\\varepsilon\_\{m\}\.\(4\.8\)Under human admissibility, bothPi,kP\_\{i,k\}andP^H\(m\)\\widehat\{P\}\_\{H\}^\{\(m\)\}are supported on𝒜i\\mathcal\{A\}\_\{i\}\. At block boundaries, the triangle inequality, \([2\.2](https://arxiv.org/html/2608.26797#S2.E2)\), and \([4\.8](https://arxiv.org/html/2608.26797#S4.E8)\) give

Δi,\(q\+1\)​ℓm\\displaystyle\\Delta\_\{i,\(q\+1\)\\ell\_\{m\}\}≤dTV​\(Pi,q​ℓm​Ti,mℓm,P^H\(m\)​Ti,mℓm\)\+dTV​\(P^H\(m\)​Ti,mℓm,P^H\(m\)\)\\displaystyle\\leq d\_\{\\mathrm\{TV\}\}\\left\(P\_\{i,q\\ell\_\{m\}\}T\_\{i,m\}^\{\\ell\_\{m\}\},\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\}^\{\\ell\_\{m\}\}\\right\)\+d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\}^\{\\ell\_\{m\}\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\(4\.9\)≤ρm​Δi,q​ℓm\+ℓm​εm\.\\displaystyle\\leq\\rho\_\{m\}\\Delta\_\{i,q\\ell\_\{m\}\}\+\\ell\_\{m\}\\varepsilon\_\{m\}\.\(4\.10\)Iteration yields

Δi,q​ℓm≤ρmq​Δi,0\+ℓm​1−ρmq1−ρm​εm\.\\Delta\_\{i,q\\ell\_\{m\}\}\\leq\\rho\_\{m\}^\{q\}\\Delta\_\{i,0\}\+\\ell\_\{m\}\\frac\{1\-\\rho\_\{m\}^\{q\}\}\{1\-\\rho\_\{m\}\}\\varepsilon\_\{m\}\.\(4\.11\)For a remainder1≤r<ℓm1\\leq r<\\ell\_\{m\}, nonexpansiveness and \([4\.8](https://arxiv.org/html/2608.26797#S4.E8)\) give

Δi,q​ℓm\+r\\displaystyle\\Delta\_\{i,q\\ell\_\{m\}\+r\}≤dTV​\(Pi,q​ℓm​Ti,mr,P^H\(m\)​Ti,mr\)\+dTV​\(P^H\(m\)​Ti,mr,P^H\(m\)\)\\displaystyle\\leq d\_\{\\mathrm\{TV\}\}\\left\(P\_\{i,q\\ell\_\{m\}\}T\_\{i,m\}^\{r\},\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\}^\{r\}\\right\)\+d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}T\_\{i,m\}^\{r\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\(4\.12\)≤Δi,q​ℓm\+r​εm\.\\displaystyle\\leq\\Delta\_\{i,q\\ell\_\{m\}\}\+r\\varepsilon\_\{m\}\.\(4\.13\)Combining this inequality with \([4\.11](https://arxiv.org/html/2608.26797#S4.E11)\) proves \([4\.3](https://arxiv.org/html/2608.26797#S4.E3)\)\. The proof shows that each block of perturbations contracts the current machine–human discrepancy by a factorρm\\rho\_\{m\}, while incurring only the additional drift caused by imperfect human stability\. Iterating this one\-block relation yields the stated convergence rate\. It is easy to see that ifεm=0\\varepsilon\_\{m\}=0, then

dTV​\(P¯M,k\(p,m\),P^H\(m\)\)≤ρm⌊k/ℓm⌋​Δ¯0⟶0\.d\_\{\\mathrm\{TV\}\}\\left\(\\overline\{P\}\_\{M,k\}^\{\(p,m\)\},\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)\\leq\\rho\_\{m\}^\{\\lfloor k/\\ell\_\{m\}\\rfloor\}\\overline\{\\Delta\}\_\{0\}\\longrightarrow 0\.\(4\.14\)∎

## 5Sample Requirements

In Section 3, we showed that repeated perturbations can drive the machine distribution toward the empirical human distribution\. A natural next question is how much data is required for this guarantee to be meaningful: how many human samples and machine samples are necessary to ensure that the observed perturbed distribution is close to the human distribution?

For comparisons about the semantics of the text, a finite mapϕ:𝒴→\{1,…,r\}\\phi:\\mathcal\{Y\}\\to\\\{1,\\ldots,r\\\}, where the categories are semantic classes\. For a distributionPP, letPϕP^\{\\phi\}denote the distribution ofϕ⁡\(Y\)\\phi\(Y\)whenY∼PY\\sim P\. Since applyingϕ\\phicannot increase Total Variation,dTV​\(Pϕ,Qϕ\)≤dTV​\(P,Q\)\.d\_\{\\mathrm\{TV\}\}\(P^\{\\phi\},Q^\{\\phi\}\)\\leq d\_\{\\mathrm\{TV\}\}\(P,Q\)\.All forward bounds therefore remain valid after this representation is applied\. For the learning\-rate derivation below, we additionally treat therrcells as the state space of the perturbation chain\.

###### Lemma 2\(Finite\-state Total Variation concentration\)\.

To translate the distributional convergence from Section 3 into a finite\-sample guarantee, we first quantify how well an empirical measure over r categories approximates the average distribution generating those observations\. LetZ1,…,ZnZ\_\{1\},\\ldots,Z\_\{n\}be independent random variables taking values in\{1,…,r\}\\\{1,\\ldots,r\\\}, not necessarily identically distributed\. Define

P^n=1n​∑j=1nδZj,P¯n=1n​∑j=1nℒ⁡\(Zj\)\.\\widehat\{P\}\_\{n\}=\\frac\{1\}\{n\}\\sum\_\{j=1\}^\{n\}\\delta\_\{Z\_\{j\}\},\\qquad\\overline\{P\}\_\{n\}=\\frac\{1\}\{n\}\\sum\_\{j=1\}^\{n\}\\mathcal\{L\}\(Z\_\{j\}\)\.\(5\.1\)Then, with probability at least1−δ1\-\\delta,

dTV​\(P^n,P¯n\)≤cr​\(n,δ\):=r\+2​log⁡\(1/δ\)2​n\.d\_\{\\mathrm\{TV\}\}\(\\widehat\{P\}\_\{n\},\\overline\{P\}\_\{n\}\)\\leq c\_\{r\}\(n,\\delta\):=\\frac\{\\sqrt\{r\}\+\\sqrt\{2\\log\(1/\\delta\)\}\}\{2\\sqrt\{n\}\}\.\(5\.2\)

###### Proof\.

Writepj,a=ℙ⁡\(Zj=a\)p\_\{j,a\}=\\mathbb\{P\}\(Z\_\{j\}=a\)\. By Cauchy–Schwarz,

𝔼​‖P^n−P¯n‖1\\displaystyle\\mathbb\{E\}\\left\\\|\\widehat\{P\}\_\{n\}\-\\overline\{P\}\_\{n\}\\right\\\|\_\{1\}≤∑a=1rVar⁡\(P^n​\(a\)\)\\displaystyle\\leq\\sum\_\{a=1\}^\{r\}\\sqrt\{\\operatorname\{Var\}\(\\widehat\{P\}\_\{n\}\(a\)\)\}\(5\.3\)≤r​∑a=1rVar⁡\(P^n​\(a\)\)\\displaystyle\\leq\\sqrt\{r\\sum\_\{a=1\}^\{r\}\\operatorname\{Var\}\(\\widehat\{P\}\_\{n\}\(a\)\)\}\(5\.4\)=rn2​∑j=1n\(1−∑a=1rpj,a2\)≤rn\.\\displaystyle=\\sqrt\{\\frac\{r\}\{n^\{2\}\}\\sum\_\{j=1\}^\{n\}\\left\(1\-\\sum\_\{a=1\}^\{r\}p\_\{j,a\}^\{2\}\\right\)\}\\leq\\sqrt\{\\frac\{r\}\{n\}\}\.\(5\.5\)Hence𝔼​dTV​\(P^n,P¯n\)≤r/\(2​n\)\\mathbb\{E\}d\_\{\\mathrm\{TV\}\}\(\\widehat\{P\}\_\{n\},\\overline\{P\}\_\{n\}\)\\leq\\sqrt\{r\}/\(2\\sqrt\{n\}\)\. Replacing one observation changes the Total Variation distance by at most1/n1/n\. McDiarmid’s inequality therefore adds at mostlog⁡\(1/δ\)/\(2​n\)\\sqrt\{\\log\(1/\\delta\)/\(2n\)\}, which gives \([5\.2](https://arxiv.org/html/2608.26797#S5.E2)\)\. ∎

The empirical approximation error decreases at then−1/2n^\{\-1/2\}rate, with dependence on the number of categories\(r\)\(r\)and the confidence level\(δ\)\(\\delta\)\. Thus, with more samples, the empirical distribution across the \(r\) categories increasingly reflects the underlying distribution\.

### 5\.1Observed machine samples and the true human target

We now ask whether the perturbed\-machine samples themselves approximate the true human distribution, rather than only the empirical human target\. This requires accounting for the finite\-sample error introduced by observing onlyppperturbed outputs andmmhuman responses\. Draw one perturbed output from each starting machine response,

Yi\(k\)∼Pi,k,i=1,…,p,Y\_\{i\}^\{\(k\)\}\\sim P\_\{i,k\},\\qquad i=1,\\ldots,p,\(5\.6\)independently, and define

P^M,kobs=1p​∑i=1pδYi\(k\)\.\\widehat\{P\}\_\{M,k\}^\{\\mathrm\{obs\}\}=\\frac\{1\}\{p\}\\sum\_\{i=1\}^\{p\}\\delta\_\{Y\_\{i\}^\{\(k\)\}\}\.\(5\.7\)
The following theorem bounds the Total Variation distance between the observed perturbed\-machine distribution and the true human distribution\.

###### Theorem 2\(Finite\-sample Total Variation bound\)\.

Fix a finite representationϕ:𝒴→\{1,…,r\}\\phi:\\mathcal\{Y\}\\to\\\{1,\\ldots,r\\\}\. Under the assumptions of Theorem[1](https://arxiv.org/html/2608.26797#Thmtheorem1), with probability at least1−δ1\-\\delta,

dTV​\(\(P^M,kobs\)ϕ,PHϕ\)≤bk,m,p\+cr​\(p,δ2\)\+cr​\(m,δ2\)\.d\_\{\\mathrm\{TV\}\}\\left\(\\left\(\\widehat\{P\}\_\{M,k\}^\{\\mathrm\{obs\}\}\\right\)^\{\\phi\},P\_\{H\}^\{\\phi\}\\right\)\\leq b\_\{k,m,p\}\+c\_\{r\}\\left\(p,\\frac\{\\delta\}\{2\}\\right\)\+c\_\{r\}\\left\(m,\\frac\{\\delta\}\{2\}\\right\)\.\(5\.8\)If the target of interest is only the observed empirical human distribution, then with probability at least1−δ1\-\\delta,

dTV​\(\(P^M,kobs\)ϕ,\(P^H\(m\)\)ϕ\)≤bk,m,p\+cr​\(p,δ\)\.d\_\{\\mathrm\{TV\}\}\\left\(\\left\(\\widehat\{P\}\_\{M,k\}^\{\\mathrm\{obs\}\}\\right\)^\{\\phi\},\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)^\{\\phi\}\\right\)\\leq b\_\{k,m,p\}\+c\_\{r\}\(p,\\delta\)\.\(5\.9\)

###### Proof\.

For the first claim, apply the triangle inequality:

dTV​\(\(P^M,kobs\)ϕ,PHϕ\)\\displaystyle d\_\{\\mathrm\{TV\}\}\\left\(\\left\(\\widehat\{P\}\_\{M,k\}^\{\\mathrm\{obs\}\}\\right\)^\{\\phi\},P\_\{H\}^\{\\phi\}\\right\)≤dTV​\(\(P^M,kobs\)ϕ,\(P¯M,k\(p,m\)\)ϕ\)\\displaystyle\\leq d\_\{\\mathrm\{TV\}\}\\left\(\\left\(\\widehat\{P\}\_\{M,k\}^\{\\mathrm\{obs\}\}\\right\)^\{\\phi\},\\left\(\\overline\{P\}\_\{M,k\}^\{\(p,m\)\}\\right\)^\{\\phi\}\\right\)\(5\.10\)\+dTV​\(\(P¯M,k\(p,m\)\)ϕ,\(P^H\(m\)\)ϕ\)\\displaystyle\\quad\+d\_\{\\mathrm\{TV\}\}\\left\(\\left\(\\overline\{P\}\_\{M,k\}^\{\(p,m\)\}\\right\)^\{\\phi\},\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)^\{\\phi\}\\right\)\(5\.11\)\+dTV​\(\(P^H\(m\)\)ϕ,PHϕ\)\.\\displaystyle\\quad\+d\_\{\\mathrm\{TV\}\}\\left\(\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)^\{\\phi\},P\_\{H\}^\{\\phi\}\\right\)\.\(5\.12\)Lemma[2](https://arxiv.org/html/2608.26797#Thmlemma2)bounds the first and third terms, and Theorem[1](https://arxiv.org/html/2608.26797#Thmtheorem1)bounds the middle term\. A union bound gives probability1−δ1\-\\delta\. The second claim omits the final human\-estimation term\. ∎

Our bound consists of three parts\. The first,bk,m,pb\_\{k,m,p\}, is the perturbation error from Theorem[1](https://arxiv.org/html/2608.26797#Thmtheorem1); it is small once enough rounds have been applied\. The second,cr​\(p,δ/2\)c\_\{r\}\(p,\\delta/2\), is the error from observing onlyppperturbed outputs\. The third,cr​\(m,δ/2\)c\_\{r\}\(m,\\delta/2\), is the error from estimating the human distribution frommmsamples\. Each vanishes askk,pp, andmmgrow, so the observed perturbed\-machine distribution converges to the true human distribution under the representationϕ\\phi\.

###### Corollary 1\(Explicitmmandppfor the sampling terms\)\.

To make the two sampling terms in \([5\.8](https://arxiv.org/html/2608.26797#S5.E8)\) sum to at mostϵ\\epsilon, it is sufficient that

m,p≥\(r\+2​log⁡\(2/δ\)\)2ϵ2\.m,p\\geq\\frac\{\\left\(\\sqrt\{r\}\+\\sqrt\{2\\log\(2/\\delta\)\}\\right\)^\{2\}\}\{\\epsilon^\{2\}\}\.\(5\.13\)Thus the sufficient scaling is

m,p=O⁡\(r\+log⁡\(1/δ\)ϵ2\)\.m,p=O\\left\(\\frac\{r\+\\log\(1/\\delta\)\}\{\\epsilon^\{2\}\}\\right\)\.\(5\.14\)

###### Proof\.

Under \([5\.13](https://arxiv.org/html/2608.26797#S5.E13)\), each termcr​\(n,δ/2\)c\_\{r\}\(n,\\delta/2\)is at mostϵ/2\\epsilon/2by direct substitution into \([5\.2](https://arxiv.org/html/2608.26797#S5.E2)\)\. ∎

The requirement in \([5\.14](https://arxiv.org/html/2608.26797#S5.E14)\) grows linearly in the number of representation classesrrand like1/ϵ21/\\epsilon^\{2\}in the target accuracy, but only logarithmically in1/δ1/\\delta\. Halvingϵ\\epsilontherefore requires four times as many samples, whereas a much stronger confidence guarantee requires only a modest increase\.

### 5\.2Deriving a pertubation rate

We now boundεm\\varepsilon\_\{m\}, previously assumed, in terms of the number of observed human responsesmm\. Among the kernels satisfying the required contraction property, we select the one that comes closest to leaving the empirical human distribution unchanged\.

We work on the finite state space\{1,…,r\}\\\{1,\\ldots,r\\\}described above, interpret the preceding movement theorem on this state space, and write

H=PHϕ,H^m=\(P^H\(m\)\)ϕ\.H=P\_\{H\}^\{\\phi\},\\qquad\\widehat\{H\}\_\{m\}=\\left\(\\widehat\{P\}\_\{H\}^\{\(m\)\}\\right\)^\{\\phi\}\.\(5\.15\)Fix a block lengthℓ≥1\\ell\\geq 1and a block contraction factorρ∈\[0,1\)\\rho\\in\[0,1\)\. For each starting responseii, let𝔗i\\mathfrak\{T\}\_\{i\}be a nonempty finite class of admissible Markov kernels on\{1,…,r\}\\\{1,\\ldots,r\\\}such that everyT∈𝔗iT\\in\\mathfrak\{T\}\_\{i\}satisfies

dTV​\(P​Tℓ,Q​Tℓ\)≤ρ​dTV​\(P,Q\)d\_\{\\mathrm\{TV\}\}\(PT^\{\\ell\},QT^\{\\ell\}\)\\leq\\rho d\_\{\\mathrm\{TV\}\}\(P,Q\)\(5\.16\)for all distributionsP,QP,Q\. Proposition[1](https://arxiv.org/html/2608.26797#Thmproposition1)gives one way to enforce this constraint through anℓ\\ell\-step minorization condition\.

Select the learned kernel by empirical stationarity minimization:

Ti,m∈arg​minT∈𝔗i⁡dTV​\(H^m​T,H^m\)\.T\_\{i,m\}\\in\\operatorname\*\{arg\\,min\}\_\{T\\in\\mathfrak\{T\}\_\{i\}\}d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{H\}\_\{m\}T,\\widehat\{H\}\_\{m\}\\right\)\.\(5\.17\)
###### Theorem 3\(Derived stability rate\)\.

If the feasible class contains a kernel that preserves the true human distribution, we quantify how closely the empirically selected kernel reaches this stability\. Assume that, for everyii, the feasible class contains a population\-stationary comparatorTi⋆∈𝔗iT\_\{i\}^\{\\star\}\\in\\mathfrak\{T\}\_\{i\}satisfying

H​Ti⋆=H\.HT\_\{i\}^\{\\star\}=H\.\(5\.18\)Then the kernels selected by \([5\.17](https://arxiv.org/html/2608.26797#S5.E17)\) satisfy, with probability at least1−δ1\-\\delta,

εm≤2​cr​\(m,δ\)=r\+2​log⁡\(1/δ\)m\.\\varepsilon\_\{m\}\\leq 2c\_\{r\}\(m,\\delta\)=\\frac\{\\sqrt\{r\}\+\\sqrt\{2\\log\(1/\\delta\)\}\}\{\\sqrt\{m\}\}\.\(5\.19\)
The resultingm−1/2m^\{\-1/2\}rate shows that the human\-stability error decreases with the amount of human data: as m increases, the empirically learned perturbation rule becomes increasingly stable with respect to the human distribution\.

###### Proof\.

By empirical optimality,

dTV​\(H^m​Ti,m,H^m\)≤dTV​\(H^m​Ti⋆,H^m\)\.d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{H\}\_\{m\}T\_\{i,m\},\\widehat\{H\}\_\{m\}\\right\)\\leq d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{H\}\_\{m\}T\_\{i\}^\{\\star\},\\widehat\{H\}\_\{m\}\\right\)\.\(5\.20\)Stationarity ofHHand nonexpansiveness of Markov kernels give

dTV​\(H^m​Ti⋆,H^m\)\\displaystyle d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{H\}\_\{m\}T\_\{i\}^\{\\star\},\\widehat\{H\}\_\{m\}\\right\)≤dTV​\(H^m​Ti⋆,H​Ti⋆\)\+dTV​\(H,H^m\)\\displaystyle\\leq d\_\{\\mathrm\{TV\}\}\\left\(\\widehat\{H\}\_\{m\}T\_\{i\}^\{\\star\},HT\_\{i\}^\{\\star\}\\right\)\+d\_\{\\mathrm\{TV\}\}\(H,\\widehat\{H\}\_\{m\}\)\(5\.21\)≤2​dTV​\(H^m,H\)\.\\displaystyle\\leq 2d\_\{\\mathrm\{TV\}\}\(\\widehat\{H\}\_\{m\},H\)\.\(5\.22\)Taking the maximum overiiyields

εm≤2​dTV​\(H^m,H\)\.\\varepsilon\_\{m\}\\leq 2d\_\{\\mathrm\{TV\}\}\(\\widehat\{H\}\_\{m\},H\)\.\(5\.23\)Lemma[2](https://arxiv.org/html/2608.26797#Thmlemma2)applied to the human sample gives \([5\.19](https://arxiv.org/html/2608.26797#S5.E19)\)\. ∎

The realizability condition \([5\.18](https://arxiv.org/html/2608.26797#S5.E18)\) can be relaxed\. If the best feasible comparator has population one\-step stationarity defect at mostη\\eta, the same argument addsη\\etato the right\-hand side of \([5\.19](https://arxiv.org/html/2608.26797#S5.E19)\); the stochastic term remainsm−1/2m^\{\-1/2\}\.

###### Corollary 2\(Explicit block and sample rate\)\.

We now substitute the learned stability rate into the convergence bound to make the dependence on the number of perturbation rounds and human samples explicit\. Under Theorem[3](https://arxiv.org/html/2608.26797#Thmtheorem3), setℓm=ℓ\\ell\_\{m\}=\\ellandρm≤ρ\\rho\_\{m\}\\leq\\rho\. At a block endpointk=q​ℓk=q\\ell, with probability at least1−δ1\-\\delta,

bq​ℓ,m,p≤ρq\+ℓ⁡\(r\+2​log⁡\(1/δ\)\)\(1−ρ\)​m\.b\_\{q\\ell,m,p\}\\leq\\rho^\{q\}\+\\frac\{\\ell\\left\(\\sqrt\{r\}\+\\sqrt\{2\\log\(1/\\delta\)\}\\right\)\}\{\(1\-\\rho\)\\sqrt\{m\}\}\.\(5\.24\)For an arbitraryk=q​ℓ\+rkk=q\\ell\+r\_\{k\},

bk,m,p≤ρq\+\(ℓ1−ρ\+ℓ−1\)​r\+2​log⁡\(1/δ\)m\.b\_\{k,m,p\}\\leq\\rho^\{q\}\+\\left\(\\frac\{\\ell\}\{1\-\\rho\}\+\\ell\-1\\right\)\\frac\{\\sqrt\{r\}\+\\sqrt\{2\\log\(1/\\delta\)\}\}\{\\sqrt\{m\}\}\.\(5\.25\)Consequently,

bk,m,p=O⁡\(ρ⌊k/ℓ⌋\+ℓ1−ρ​r\+log⁡\(1/δ\)m\)\.b\_\{k,m,p\}=O\\left\(\\rho^\{\\lfloor k/\\ell\\rfloor\}\+\\frac\{\\ell\}\{1\-\\rho\}\\sqrt\{\\frac\{r\+\\log\(1/\\delta\)\}\{m\}\}\\right\)\.\(5\.26\)

###### Proof\.

UseΔ¯0≤1\\overline\{\\Delta\}\_\{0\}\\leq 1, Theorem[1](https://arxiv.org/html/2608.26797#Thmtheorem1), and \([5\.19](https://arxiv.org/html/2608.26797#S5.E19)\)\. At a block endpoint the remainder term vanishes\. For arbitrarykk, userk≤ℓ−1r\_\{k\}\\leq\\ell\-1and\(1−ρq\)/\(1−ρ\)≤1/\(1−ρ\)\(1\-\\rho^\{q\}\)/\(1\-\\rho\)\\leq 1/\(1\-\\rho\)\. ∎

In \([5\.26](https://arxiv.org/html/2608.26797#S5.E26)\), the termρ⌊k/ℓ⌋\\rho^\{\\lfloor k/\\ell\\rfloor\}decays geometrically in the number of perturbation rounds, while the term of orderm−1/2m^\{\-1/2\}depends only on the human sample size\.

###### Proposition 2\(Human data and perturbation rounds from the derived rate\)\.

We now invert the rate in Corollary 4\.5 to obtain explicit sufficient choices of the number of perturbation blocks and human samples needed to achieve a target error levelϵ\\epsilon\. Fix0<ϵ<10<\\epsilon<1and0<δ<10<\\delta<1\. For0<ρ<10<\\rho<1, it is sufficient to choose

q\\displaystyle q≥⌈log⁡\(2/ϵ\)−log⁡ρ⌉,k=q​ℓ,\\displaystyle\\geq\\left\\lceil\\frac\{\\log\(2/\\epsilon\)\}\{\-\\log\\rho\}\\right\\rceil,\\qquad k=q\\ell,\(5\.27\)m\\displaystyle m≥4​ℓ2​\(r\+2​log⁡\(1/δ\)\)2\(1−ρ\)2​ϵ2\\displaystyle\\geq\\frac\{4\\ell^\{2\}\\left\(\\sqrt\{r\}\+\\sqrt\{2\\log\(1/\\delta\)\}\\right\)^\{2\}\}\{\(1\-\\rho\)^\{2\}\\epsilon^\{2\}\}\(5\.28\)to guaranteebk,m,p≤ϵb\_\{k,m,p\}\\leq\\epsilonwith probability at least1−δ1\-\\delta\. Ifρ=0\\rho=0, one block,q=1q=1, is sufficient\.

###### Proof\.

The choices make the geometric and statistical terms in \([5\.24](https://arxiv.org/html/2608.26797#S5.E24)\) at mostϵ/2\\epsilon/2each\. ∎

Proposition[2](https://arxiv.org/html/2608.26797#Thmproposition2)makes the two requirements explicit\. The number of perturbation rounds in \([5\.27](https://arxiv.org/html/2608.26797#S5.E27)\) grows only logarithmically in1/ϵ1/\\epsilon, while the number of human samples in \([5\.28](https://arxiv.org/html/2608.26797#S5.E28)\) grows like1/ϵ21/\\epsilon^\{2\}\. The human sample size therefore governs how smallϵ\\epsiloncan be made\.

## 6Discussion

Our results reframe paraphrasing attacks as a question about data\. Prior work shows that recursive paraphrasing weakens detectors, but an unguided paraphraser drifts toward its own style rather than any particular person’s\. Access to human examples changes this\. Theorem[1](https://arxiv.org/html/2608.26797#Thmtheorem1)shows convergence up to an error determined by how stable the human distribution is under the paraphraser, while Theorem[3](https://arxiv.org/html/2608.26797#Thmtheorem3)shows that this stability improves as more human examples become available\.

Our analysis has two main limitations\. First, the finite\-sample guarantees are stated under a finite representationϕ\\phi, so matching a coarse representation may still leave differences that a detector can exploit\. Our theory requires the paraphrasing process to satisfy the block\-mixing condition, but we do not empirically verify this property for practical paraphrasers\.

These limitations suggest several directions for future work\. A more refined theory could introduce a parameter that captures variation within the human distribution and study how this changes the required sample size\. It would also be useful to develop practical training procedures for paraphrasers that use human examples while satisfying conditions assumed here\.

## References

- \[1\]H\. Johnston, R\. F\. Wells, E\. M\. Shanks, T\. Boey, and B\. N\. Parsons\(2024\)Student perspectives on the use of generative artificial intelligence technologies in higher education\.International Journal for Educational Integrity20\(1\),pp\. 2\.External Links:[Document](https://dx.doi.org/10.1007/s40979-024-00149-4)Cited by:[§1](https://arxiv.org/html/2608.26797#S1.p1.1)\.
- \[2\]W\. Yeadon, E\. Agra, O\. Inyang, P\. Mackay, and A\. Mizouri\(2024\)Evaluating AI and human authorship quality in academic writing through physics essays\.European Journal of Physics45\(5\),pp\. 055703\.External Links:[Document](https://dx.doi.org/10.1088/1361-6404/ad669d)Cited by:[§1](https://arxiv.org/html/2608.26797#S1.p1.1)\.
- \[3\]D\. Weber\-Wulff, A\. Anohina\-Naumeca, S\. Bjelobaba, T\. Foltýnek, J\. Guerrero\-Dib, O\. Popoola, P\. Šigut, and L\. Waddington\(2023\)Testing of detection tools for AI\-generated text\.International Journal for Educational Integrity19\(1\),pp\. 26\.External Links:[Document](https://dx.doi.org/10.1007/s40979-023-00146-z)Cited by:[§1](https://arxiv.org/html/2608.26797#S1.p1.1),[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px1.p1.1)\.
- \[4\]V\. S\. Sadasivan, A\. Kumar, S\. Balasubramanian, W\. Wang, and S\. Feizi\(2023\)Can AI\-generated text be reliably detected?\.arXiv preprint arXiv:2303\.11156\.Cited by:[§1](https://arxiv.org/html/2608.26797#S1.p1.1),[§1](https://arxiv.org/html/2608.26797#S1.p2.1),[§2](https://arxiv.org/html/2608.26797#S2.p4.1),[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px2.p1.1),[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px3.p1.1)\.
- \[5\]S\. Chakraborty, A\. Bedi, S\. Zhu, B\. An, D\. Manocha, and F\. Huang\(2024\)Position: on the possibilities of AI\-generated text detection\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 6093–6115\.Cited by:[§1](https://arxiv.org/html/2608.26797#S1.p2.1),[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px2.p1.1)\.
- \[6\]E\. Masrour, B\. Emi, and M\. Spero\(2025\)DAMAGE: detecting adversarially modified AI generated text\.arXiv preprint arXiv:2501\.03437\.Cited by:[§2](https://arxiv.org/html/2608.26797#S2.p4.1)\.
- \[7\]Y\. E\. Xu, Z\. Zhong, A\. Raghunathan, F\. Fang, and J\. Z\. Kolter\(2026\)Base models look human to AI detectors\.arXiv preprint arXiv:2605\.19516\.Cited by:[§2](https://arxiv.org/html/2608.26797#S2.p4.1)\.
- \[8\]J\. S\. Rosenthal\(1995\)Minorization conditions and convergence rates for markov chain monte carlo\.Journal of the American Statistical Association90\(430\),pp\. 558–566\.External Links:[Document](https://dx.doi.org/10.1080/01621459.1995.10476548)Cited by:[Assumption 3](https://arxiv.org/html/2608.26797#Thmassumption3.p1.2)\.
- \[9\]S\. Gehrmann, H\. Strobelt, and A\. Rush\(2019\)GLTR: statistical detection and visualization of generated text\.InProceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations,pp\. 111–116\.External Links:[Document](https://dx.doi.org/10.18653/v1/P19-3019)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px1.p1.1)\.
- \[10\]V\. Verma, E\. Fleisig, N\. Tomlin, and D\. Klein\(2024\)Ghostbuster: detecting text ghostwritten by large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,pp\. 1702–1717\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.95)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px1.p1.1)\.
- \[11\]E\. Mitchell, Y\. Lee, A\. Khazatsky, C\. D\. Manning, and C\. Finn\(2023\)DetectGPT: zero\-shot machine\-generated text detection using probability curvature\.InProceedings of the 40th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.202,pp\. 24950–24962\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px1.p1.1)\.
- \[12\]G\. Bao, Y\. Zhao, Z\. Teng, L\. Yang, and Y\. Zhang\(2024\)Fast\-DetectGPT: efficient zero\-shot detection of machine\-generated text via conditional probability curvature\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Bpcgcr8E8Z)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px1.p1.1)\.
- \[13\]J\. Kirchenbauer, J\. Geiping, Y\. Wen, J\. Katz, I\. Miers, and T\. Goldstein\(2023\)A watermark for large language models\.InProceedings of the 40th International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.202,pp\. 17061–17084\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px1.p1.1)\.
- \[14\]L\. Dugan, A\. Hwang, F\. Trhlík, A\. Zhu, J\. M\. Ludan, H\. Xu, D\. Ippolito, and C\. Callison\-Burch\(2024\)RAID: a shared benchmark for robust evaluation of machine\-generated text detectors\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics,pp\. 12463–12492\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.674)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px1.p1.1)\.
- \[15\]L\. R\. Varshney, N\. S\. Keskar, and R\. Socher\(2020\)Limits of detecting text generated by large\-scale language models\.In2020 Information Theory and Applications Workshop,pp\. 1–5\.External Links:[Document](https://dx.doi.org/10.1109/ITA50056.2020.9245012)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px2.p1.1)\.
- \[16\]K\. Krishna, Y\. Song, M\. Karpinska, J\. Wieting, and M\. Iyyer\(2023\)Paraphrasing evades detectors of AI\-generated text, but retrieval is an effective defense\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Document](https://dx.doi.org/10.52202/075280-1195)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px3.p1.1)\.
- \[17\]Z\. Shi, Y\. Wang, F\. Yin, X\. Chen, K\. Chang, and C\. Hsieh\(2024\)Red teaming language model detectors with language models\.Transactions of the Association for Computational Linguistics12,pp\. 174–189\.External Links:[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00639)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px3.p1.1)\.
- \[18\]C\. Nicks, E\. Mitchell, R\. Rafailov, A\. Sharma, C\. D\. Manning, C\. Finn, and S\. Ermon\(2024\)Language model detectors are easily optimized against\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=4eJDMjYZZG)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px3.p1.1)\.
- \[19\]Y\. Cheng, V\. S\. Sadasivan, M\. Saberi, S\. Saha, and S\. Feizi\(2025\)Adversarial paraphrasing: a universal attack for humanizing AI\-generated text\.InAdvances in Neural Information Processing Systems,Vol\.38\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px3.p1.1)\.
- \[20\]M\. R\. Brennan and R\. Greenstadt\(2009\)Practical attacks against authorship recognition techniques\.InProceedings of the Twenty\-First Conference on Innovative Applications of Artificial Intelligence,pp\. 60–65\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px4.p1.1)\.
- \[21\]J\. Bevendorff, M\. Potthast, M\. Hagen, and B\. Stein\(2019\)Heuristic authorship obfuscation\.InProceedings of the 57th Annual Meeting of the Association for Computational Linguistics,pp\. 1098–1108\.External Links:[Document](https://dx.doi.org/10.18653/v1/P19-1104)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px4.p1.1)\.
- \[22\]T\. Gröndahl and N\. Asokan\(2020\)Effective writing style transfer via combinatorial paraphrasing\.Proceedings on Privacy Enhancing Technologies2020\(4\),pp\. 175–195\.External Links:[Document](https://dx.doi.org/10.2478/popets-2020-0068)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px4.p1.1)\.
- \[23\]S\. Liu, S\. Agarwal, and J\. May\(2024\)Authorship style transfer with policy optimization\.arXiv preprint arXiv:2403\.08043\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px4.p1.1)\.
- \[24\]N\. I\. Tripto, S\. Venkatraman, D\. Macko, R\. Moro, I\. Srba, A\. Uchendu, T\. Le, and D\. Lee\(2024\)A ship of theseus: curious cases of paraphrasing in LLM\-generated texts\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics,pp\. 6608–6625\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.357)Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px5.p1.1)\.
- \[25\]Z\. Wang, Y\. Li, J\. Yan, Y\. Cheng, and Y\. Zhang\(2025\)Unveiling attractor cycles in large language models: a dynamical systems view of successive paraphrasing\.arXiv preprint arXiv:2502\.15208\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px5.p1.1)\.
- \[26\]M\. Geng, A\. Mohamed, G\. Shang, M\. Vazirgiannis, and T\. Poibeau\(2026\)Markovian generation chains in large language models\.arXiv preprint arXiv:2603\.11228\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px5.p1.1)\.
- \[27\]H\. Zhang, B\. L\. Edelman, D\. Francati, D\. Venturi, G\. Ateniese, and B\. Barak\(2024\)Watermarks in the sand: impossibility of strong watermarking for language models\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 58851–58880\.Cited by:[§3](https://arxiv.org/html/2608.26797#S3.SS0.SSS0.Px6.p1.1)\.